SC-300 sample exam questions

Seamless SSO needs the Microsoft Entra URL https://autologon.microsoftazuread-sso.com added to the browser's Local intranet zone, usually by Group Policy, so Kerberos tickets are sent automatically. No authentication agent or Enterprise State Roaming is needed on the client.

Defining custom security attributes needs the Attribute Definition Administrator role. Global Administrators don't get it by default. Custom security attributes can be assigned to users, enterprise applications (service principals), and managed identities, but not to groups.

Key Vault Crypto Officer can do any action on keys, including creating and managing them. Of the roles listed, only Key Vault Certificates Officer gives access to certificates. The narrower Key Vault Certificate User role would be even less privileged, but it isn't offered.

SharePoint's unmanaged-device control treats a device as managed only if it is hybrid joined or marked compliant in Intune. Device2 is compliant, so User2 gets full access. Device1 is Entra joined but noncompliant and Device3 is unknown, so User1 and User3 get web-only limited access.

Azure resources such as VMs and App Service apps accept managed identities only: one system-assigned identity plus any number of user-assigned identities. A regular user account like User1 can never be attached to a resource as its identity.

The community answer is likely wrong. Microsoft Graph documents that application owners can be individual users or service principals. Groups, whether security or Microsoft 365, cannot be owners of an app registration. User1 and SP1 can therefore be owners of App1, although the portal only offers users.

Sign-in logs record each sign-in's IP address and location. Audit logs record directory changes to objects such as users and service principals. Identity secure score measures your security configuration against best practices and lists improvement actions.

Usage and insights for enterprise applications shows sign-in counts, success rate, and failures per app out of the box, so it needs the least effort. Sign-in and audit logs hold raw events that you would have to filter and calculate yourself; access reviews are unrelated.

To send Azure AD audit logs to Log Analytics for use with Azure Monitor, first configure Diagnostic settings in Azure AD and choose the workspace as destination. The Update-Mg cmdlets change organization or domain properties, and a workbook only works after the logs flow.

Onboarding an Azure subscription requires assigning the existing Reader role to the Cloud Infrastructure Entitlements Management application, so New-AzRoleAssignment is used rather than creating a role. Reader lets it collect permission data with least privilege. Outdated: Microsoft has retired Entra Permissions Management.

To sync only the required ADatum users, rerun the Entra Connect wizard and choose Customize synchronization options to filter by domain or OU. Start-ADSyncSyncCycle only triggers a run and Set-ADSyncScheduler changes timing, while Change user sign-in alters the sign-in method.

Leaked credentials detection in Identity Protection works by comparing credentials against leaked data and requires password hash synchronization from Azure AD Connect. Password Protection blocks weak passwords, authentication method policies set methods, and PingFederate federation would not provide the hashes.

Conditional Access uses named locations defined with public IP ranges, which is the way to identify the Boston office for MFA exemptions. Private ranges cannot be seen by Entra ID, and trusted IPs are a legacy per-user MFA setting that does not fit the stated requirements.

Users must request permission when needed, so set all assignments to Eligible so activation through PIM is required. Requiring justification supports the request. The community answer AD is kept, though modifying the eligible expiry could also fit a one-year limit.

Multi-stage attack detection in Microsoft Sentinel comes from the Fusion rule, and its logic is adjusted by customizing the analytics rule. Data connectors only ingest data, workbooks only visualize, and playbooks respond after an incident rather than detecting.